Overview

overview

10

Static

static

10

SecuriteIn...77.exe

windows7_x64

3

SecuriteIn...77.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Variant.Tedy.123517.9877.3264

  • Size

    1.8MB

  • Sample

    220702-s37elagafm

  • MD5

    212b1e774e310dbe4e92b01854f31d53

  • SHA1

    635349bf28642a2a4b32155fe2864f6dfd51a483

  • SHA256

    d22de2ac8939c185e56867b691702abd0304adf75c2b62dbff801228bdcf0dbe

  • SHA512

    3c7be7251079c9610ddd5923307d4887746d6f43c8dcf81d82e2696726000cf8912be1530f1a388cd4520289bf0722dc270defbe23a631771a83befc2d9f689e

Score
10/10
gozi_ifsbwarzoneratevasioninfostealerpersistencerattrojan

Malware Config

Extracted

Family

warzonerat

C2

workstation2022.ddns.net:5254

Targets

    • Target

      SecuriteInfo.com.Variant.Tedy.123517.9877.3264

    • Size

      1.8MB

    • MD5

      212b1e774e310dbe4e92b01854f31d53

    • SHA1

      635349bf28642a2a4b32155fe2864f6dfd51a483

    • SHA256

      d22de2ac8939c185e56867b691702abd0304adf75c2b62dbff801228bdcf0dbe

    • SHA512

      3c7be7251079c9610ddd5923307d4887746d6f43c8dcf81d82e2696726000cf8912be1530f1a388cd4520289bf0722dc270defbe23a631771a83befc2d9f689e

    Score
    10/10
    warzoneratevasioninfostealerpersistencerattrojan

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Windows security bypass

      evasiontrojan

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Warzone RAT Payload

      rat

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Account Manipulation

1
T1098

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

2
T1089

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks